@everystack/server 0.2.20 → 0.2.23

package/src/role-chain.ts

@@ -0,0 +1,75 @@
+/**
+ * The role chain — generated, idempotent SQL for the least-privilege login role and the
+ * application roles it switches between.
+ *
+ * This is what the `db:provision` action runs (as the operator/owner) at deploy time so a
+ * fresh database comes up with the credential split already in place — no hand-written
+ * `CREATE ROLE`, no `ALTER ROLE … PASSWORD` in a console. The password is set separately
+ * by `db:provision` from a deploy-generated value; this module only shapes the roles and
+ * their membership graph. Table grants and RLS policies stay in the app's migrations
+ * (they're schema-specific); this is the part that must exist before those grants resolve.
+ *
+ * See docs/plans/secure-by-default-database.md.
+ */
+
+const IDENT = /^[a-z_][a-z0-9_]*$/;
+
+export interface RoleChainOptions {
+  /**
+   * The LOGIN role the API connects as — least-privilege: LOGIN, NOINHERIT (memberships
+   * are SET ROLE-only, never ambient), NOBYPASSRLS, and no grants of its own.
+   * Default 'authenticator'.
+   */
+  loginRole?: string;
+  /**
+   * The NOLOGIN application roles the login role may `SET ROLE` to, in order of privilege.
+   * Default ['anon', 'authenticated', 'admin'].
+   */
+  appRoles?: string[];
+}
+
+function assertIdent(name: string, what: string): void {
+  if (!IDENT.test(name)) {
+    throw new Error(`Invalid ${what}: ${JSON.stringify(name)} — must match ${IDENT}`);
+  }
+}
+
+/**
+ * Generate idempotent DDL that creates the application roles and the least-privilege login
+ * role, and wires the membership chain so the login role can `SET ROLE` to each. Safe to
+ * run on every deploy: each `CREATE ROLE` is `IF NOT EXISTS`-guarded, and the login role's
+ * attributes are re-asserted with `ALTER ROLE` so a role created the old way (e.g. without
+ * an explicit NOBYPASSRLS) is corrected. Does NOT set passwords — that's `db:provision`'s
+ * job, from a deploy-generated value.
+ */
+export function generateRoleChainSQL(options: RoleChainOptions = {}): string {
+  const loginRole = options.loginRole ?? 'authenticator';
+  const appRoles = options.appRoles ?? ['anon', 'authenticated', 'admin'];
+
+  assertIdent(loginRole, 'loginRole');
+  appRoles.forEach((r) => assertIdent(r, 'app role'));
+
+  const lines: string[] = [];
+
+  // Application roles — NOLOGIN; reached only via SET ROLE.
+  for (const role of appRoles) {
+    lines.push(
+      `DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${role}') THEN CREATE ROLE ${role} NOLOGIN; END IF; END $$;`,
+    );
+  }
+
+  // The least-privilege login role. Create if absent, then re-assert attributes so an
+  // existing role is brought into compliance (LOGIN, NOINHERIT, NOBYPASSRLS).
+  lines.push(
+    `DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${loginRole}') THEN CREATE ROLE ${loginRole} LOGIN NOINHERIT NOBYPASSRLS; END IF; END $$;`,
+  );
+  lines.push(`ALTER ROLE ${loginRole} WITH LOGIN NOINHERIT NOBYPASSRLS;`);
+
+  // Membership chain — the login role may SET ROLE to each app role. NOINHERIT means it
+  // gains their privileges only when it explicitly switches, never ambiently.
+  for (const role of appRoles) {
+    lines.push(`GRANT ${role} TO ${loginRole};`);
+  }
+
+  return lines.join('\n') + '\n';
+}

package/src/ssr.ts

@@ -259,6 +259,68 @@ export async function resolveBundleKey(channel: string, storage?: StorageAdapter
   return (await resolveWebRelease(channel, storage, db)).bundleKey;
 }
 
+/**
+ * Filesystem-safe, release-unique directory segment derived from the bundle ETag.
+ *
+ * expo-server loads the server bundle (render.js and every route module) via
+ * require()/import(), and Node caches modules by absolute path. If two releases
+ * are extracted to the same path, the first release's modules stay resident in
+ * Node's module cache and a warm Lambda keeps serving the old HTML forever —
+ * even though the new bundle was downloaded and the new release metadata is
+ * reported. The ETag changes whenever bundle content changes, so keying the
+ * build directory on it gives each distinct release its own path and forces a
+ * fresh module load. See __tests__/ssr-build-dir.test.ts.
+ */
+export function releaseDirSegment(etag: string): string {
+  return etag.replace(/[^a-zA-Z0-9]+/g, '') || 'default';
+}
+
+/**
+ * Evict CJS module-cache entries whose file lives under `dir`.
+ *
+ * expo-server loads the server bundle via require(), so a pruned release's
+ * modules would otherwise stay resident in Node's module cache (and uncollected)
+ * even after its files are deleted — leaking memory across releases on a warm
+ * container. Only modules under an already-pruned (inactive) release dir are
+ * evicted, so this never touches the live handler. No-op outside CJS (require
+ * unavailable) and harmless if expo-server used import() instead — the ESM
+ * registry has no eviction API, so those rely on container recycling.
+ */
+export function evictModuleCache(
+  dir: string,
+  cache: Record<string, unknown> | null =
+    (typeof require !== 'undefined' && (require.cache as unknown as Record<string, unknown>)) || null,
+): void {
+  if (!cache) return;
+  const prefix = dir.endsWith(path.sep) ? dir : dir + path.sep;
+  for (const key of Object.keys(cache)) {
+    if (key.startsWith(prefix)) delete cache[key];
+  }
+}
+
+/**
+ * Remove sibling release directories under a channel base, keeping only `keep`.
+ * Bounds /tmp usage (512MB ephemeral) AND evicts each removed release's modules
+ * from Node's module cache so they can be garbage-collected — without that, the
+ * fix to serve fresh releases would leak module memory across deploys on a
+ * long-lived warm container.
+ */
+async function pruneOldReleaseDirs(channelBase: string, keep: string): Promise<void> {
+  let entries: string[];
+  try {
+    entries = await fsp.readdir(channelBase);
+  } catch {
+    return; // base doesn't exist yet — nothing to prune
+  }
+  const keepName = path.basename(keep);
+  await Promise.all(entries.map(async (name) => {
+    if (name === keepName) return;
+    const dir = path.join(channelBase, name);
+    await fsp.rm(dir, { recursive: true, force: true }).catch(() => {});
+    evictModuleCache(dir);
+  }));
+}
+
 /**
  * Returns a Request→Response handler for the current web release,
  * or null if no web release exists yet.
@@ -275,7 +337,7 @@ export async function getWebHandler(
 ): Promise<((request: Request) => Promise<Response>) | null> {
   const now = Date.now();
   const channel = options?.channel || process.env.ENVIRONMENT || 'production';
-  const buildDir = `${BUILD_DIR_BASE}/${channel}`;
+  const channelBase = `${BUILD_DIR_BASE}/${channel}`;
 
   const cached = cachedHandlers.get(channel);
 
@@ -308,7 +370,13 @@ export async function getWebHandler(
     return wrapSsrHandler(rawHandler, options, cached.metadata);
   }
 
-  // New or updated release — download and extract server bundle archive
+  // New or updated release — extract to a RELEASE-UNIQUE directory keyed on the
+  // bundle ETag. expo-server require()s the server bundle and Node caches
+  // modules by absolute path, so re-extracting over a stable path would leave
+  // the previous release's render.js resident in a warm Lambda. A per-release
+  // path forces a fresh module load. See releaseDirSegment.
+  const buildDir = `${channelBase}/${releaseDirSegment(meta.etag)}`;
+
   try {
     await downloadAndExtract(storage, bundleKey, buildDir);
   } catch {
@@ -316,6 +384,10 @@ export async function getWebHandler(
     return null;
   }
 
+  // Drop sibling release dirs from earlier deploys so /tmp doesn't fill up
+  // across many releases on a long-lived warm container.
+  await pruneOldReleaseDirs(channelBase, buildDir);
+
   if (options?.afterExtract) {
     await options.afterExtract(buildDir);
   }